dbcve.org
Inrouter302 FirmwareOperating system · Inhandnetworks

CVE-2023-22597

MEDIUM · 5.9 CVSS v3.1 Published 2023-01-12
Fix available
A fix is available. Upgrade to 2.3.0.r5542 / 3.5.56 or later.
See remediation →
68/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

InHand Networks InRouter 302 and InRouter 615 devices transmit sensitive data (configuration information and MQTT credentials) to the cloud platform over an unencrypted channel. An attacker on the same network path could intercept this cleartext traffic to steal credentials and potentially inject commands via MQTT.

MitigationUpgrade InRouter 302 to version V3.5.56 or later, and InRouter 615 to version InRouter6XX-S-V2.3.0.r5542 or later. Alternatively, implement TLS encryption for cloud communications if upgrade is not immediately feasible.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Inrouter302 FirmwareOperating system
Affected:< 3.5.56
Inrouter615 S FirmwareOperating system
Affected:< 2.3.0.r5542

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the device model
    Access the device web interface or check the device label to confirm whether it is an InRouter 302 or InRouter 615 S model.
    Affected if The device is an InRouter 302 or InRouter 615 S model.
  2. Determine the installed firmware version
    Log into the device web interface and navigate to System Status or Device Information to view the current firmware version. Alternatively, use the command line and run 'version' or check /etc/version if accessible.
    Affected if The firmware version is lower than 3.5.56 for InRouter 302, or lower than 2.3.0.r5542 for InRouter 615 S.
  3. Check if cloud communication is enabled
    In the device web interface, look for Cloud Service, IoT Cloud, or MQTT Cloud configuration settings. Verify if any cloud platform connection is configured and enabled.
    Affected if Cloud communication to the InHand cloud platform is enabled and configured.
  4. Verify encryption status for cloud communications
    In the cloud service configuration section, check whether TLS/SSL encryption is enabled for the cloud connection. Look for settings such as 'Enable TLS', 'Use SSL', or similar encryption options.
    Affected if TLS encryption is NOT enabled for cloud communications, meaning data is transmitted in cleartext.

You are affected if you have an InRouter 302 with firmware below 3.5.56 or an InRouter 615 S below 2.3.0.r5542, with cloud communication enabled and TLS encryption disabled.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 2.3.0.r5542 / 3.5.56 or later
Fixed in 2.3.0.r55423.5.56
Interim mitigation

Upgrade InRouter 302 to version V3.5.56 or later, and InRouter 615 to version InRouter6XX-S-V2.3.0.r5542 or later. Alternatively, implement TLS encryption for cloud communications if upgrade is not immediately feasible.

Recommended fix High confidence

IR302 V3.5.56 or InRouter6XX-S-V2.3.0.r5542 (depending on model)

  1. 1. Identify the exact InRouter model (InRouter 302 or InRouter 615 S)
  2. 2. Check the current firmware version on the device through the admin console or CLI
  3. 3. Obtain the fixed firmware from InHand Networks official support: IR302 V3.5.56 for InRouter 302, or InRouter6XX-S-V2.3.0.r5542 for InRouter 615 S
  4. 4. Back up the current device configuration
  5. 5. Upload and apply the new firmware following InHand Networks' standard firmware upgrade procedure
  6. 6. After upgrade, verify the device is configured to use secured (TLS/SSL) channels for cloud platform communication
  7. 7. Confirm sensitive information such as MQTT credentials are now transmitted over encrypted channels
Caveat Review release notes for any configuration or feature changes between versions before upgrading

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Inrouter302 Firmware Scoped from the published advisory
  • Consultation2.0 h
  • Implementation3.0 h
  • Testing2.0 h
  • Review / QA1.0 h
8.0 hours of engineering $1,420
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,272.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-22597 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-22597 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data